Nr1800x Firmware (Totolink) - vulnerabilities (CVEs)

32 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2026-08-31. Vendor: Totolink.

CVEs of Nr1800x Firmware

• CVE-2026-82616 - CVSS 9.9 (critical), 2026-08-31: A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The…
• CVE-2026-82597 - CVSS 7.4 (high), 2026-08-31: A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation…
• CVE-2026-15701 - CVSS 9.8 (critical), 2026-07-14: A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of…
• CVE-2026-7548 - CVSS 8.8 (high), 2026-05-01: A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a…
• CVE-2026-7546 - CVSS 9.8 (critical), 2026-05-01: A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component…
• CVE-2026-5030 - CVSS 9.8 (critical), 2026-03-29: A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of…
• CVE-2026-1328 - CVSS 8.8 (high), 2026-01-22: A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the…
• CVE-2026-1327 - CVSS 8.8 (high), 2026-01-22: A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file…
• CVE-2026-1326 - CVSS 8.8 (high), 2026-01-22: A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi…
• CVE-2025-60686 - CVSS 5.1 (medium), 2025-11-13: A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630,…
• CVE-2025-60684 - CVSS 6.5 (medium), 2025-11-13: A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the…
• CVE-2025-60688 - CVSS 6.5 (medium), 2025-11-13: A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the…
• CVE-2025-45841 - CVSS 9.8 (critical), 2025-05-08: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
• CVE-2025-45844 - CVSS 8.8 (high), 2025-05-08: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.
• CVE-2025-45843 - CVSS 8.8 (high), 2025-05-08: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
• CVE-2025-45842 - CVSS 8.8 (high), 2025-05-08: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.
• CVE-2025-45845 - CVSS 8.8 (high), 2025-05-08: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.
• CVE-2024-35388 - CVSS 8.8 (high), 2024-05-24: TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode
• CVE-2023-7220 - CVSS 9.8 (critical), 2024-01-09: A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file…
• CVE-2023-36340 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
• CVE-2022-44256 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
• CVE-2022-41526 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.
• CVE-2022-41525 - CVSS 9.8 (critical), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi.
• CVE-2022-41528 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
• CVE-2022-41527 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function.
• CVE-2022-41523 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function.
• CVE-2022-41522 - CVSS 9.8 (critical), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function.
• CVE-2022-41524 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the…
• CVE-2022-41521 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules…
• CVE-2022-41520 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function.
• CVE-2022-41518 - CVSS 9.8 (critical), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi.
• CVE-2022-41517 - CVSS 8.8 (high), 2022-10-06: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function